Soon, soon we’ll turn off the lights, migrate these posts, and have everything at our shiny new blog at https://shostack.org/blog. And if you’re seeing this in an RSS feed, please update to https://shostack.org/feed.xml. And by the way, you’ll know you’re in the right place when you see new content about threat modeling and the JoHari Window, and also secret training discounts ..read more

If you’re seeing this in your feed, have you also seen a bad Star Wars joke? Because I’ve got one on the new blog. Please add https://shostack.org/feed.xml, or replace the feed you’re reading with it. (This is the Emergent Chaos version of this post ..read more

I’m in the process of replacing this site, adam.shostack.org, threatmodelingbook.com and the associates.shostack.org site with a new, unified https://shostack.org. I’ll be saying more about the redesign, but as part of it, I’m migrating the blog over there. There are a few new posts there that I forgot to mirror here, including: Threat Modeling Through the JoHari Window Training – October Zen and the art of not quantifying risk But most important – update your feeds! If you’re reading via RSS or ATOM, please update your feed to https://shostack.org/feed.xml. For various reasons (WordPress is ..read more

Over the years, a number of people set up Feedburner accounts to proxy RSS from our blogs into their system. I generally support the emergence of such chaos, but I cannot provide support or management. Google is end of lifing the old Feedburner, and for those of you reading via Feedburner RSS, I humbly ask that you update to https://adam.shostack.org/blog/feed/ or https://adam.shostack.org/blog/comments/feed/ (with comments ..read more

Heriot-Watt University in Scotland is hosting a “Workshop on Serious Games for Cyber Security,” May 21-22 ..read more

The White Box, and its accompanying book, “The White Box Essays” are a FANTASTIC resource, and I wish I’d had them available to me as I designed Elevation of Privilege and helped with Control-Alt-Hack. The book is for people who want to make games, and it does a lovely job of teaching you how, including things like the relationship between story and mechanics, the role of luck, how the physical elements teach the players, and the tradeoffs that you as a designer make as you design, prototype, test, refine and then get your game to market. In the go-to-market side, there are chapters on self-p ..read more

I’m getting ready for the 5-year anniversary of my book, “Threat Modeling: Designing for Security.” As part of that, I would love to see the book have more than 55 5 ⭐ reviews on Amazon. If you found the book valuable, I would appreciate it if you could take a few minutes to write a review ..read more

My Linkedin Learning course is getting really strong positive feedback. Today, I want to peel back the cover a bit, and talk about how chaotically it came to be. Before I struck a deal with Linkedin, I talked to some of the other popular training sites. Many of them will buy you a microphone and some screen recording software, and you go to town! They even “let” you edit your own videos. Those aren’t my skillsets, and I think the quality often shines through. Just not in a good way. I had a great team at Linkedin. From conceptualizing the course and the audience, through final producti ..read more

Thanks, Shawn! It’s a genre ..read more

Why would the best burger place in the United States close? Because thousands of people had the same stupid idea as you and flooded the place. Waiting times for burgers stretched to several hours, staff were overwhelmed, service declined and loyal customers were alienated. “The dark side of the quest for the world’s best burger ..read more